5b156a9033
Rainer Gerhards, rsyslog project leader, discovered an issue in rsyslogd where invalid priority values can trigger DoS and potentially RCE. As his analysis reveals, the cause of the problem identified in rsyslog's rsyslogd also exists in sysklogd's syslogd (from which rsyslogd was forked) and stems from the use of a (LOG_FACMASK|LOG_PRIMASK) mask to detect invalid priority values. In sysklogd's syslogd, invalid priority values between 192 and 1023 (directly or arrived at via overflow wraparound) can propagate through code causing out-of-bounds access to the f_pmask array within the 'filed' structure by up to 104 bytes past its end. Though most likely insufficient to reach unallocated memory because there are around 544 bytes past f_pmask in 'filed' (mod packing and other differences), incorrect access of fields at higher positions of the 'filed' structure definition can cause unexpected behavior including message mis-classification, forwarding issues, message loss, or other. This patch imposes a restriction on PRI message parts and requires they be properly-delimited priority value strings that have non-negative numerical values not exceeding 191. As before, sysklogd's syslogd permits zero padding to not break compatibility with RFC-non-compliant loggers that issue PRIs such as <0091>. Messages without well-formed PRI parts get logged with priority user.notice (13). (c.f. RFC 3164) Thanks to Rainer Gerhards for the initial report and analysis. |
||
---|---|---|
ANNOUNCE | ||
CHANGES | ||
COPYING | ||
INSTALL | ||
klogd.8 | ||
klogd.c | ||
klogd.h | ||
ksym_mod.c | ||
ksym.c | ||
ksyms.h | ||
Makefile | ||
MANIFEST | ||
module.h | ||
modutils.patch | ||
NEWS | ||
oops.c | ||
pidfile.c | ||
pidfile.h | ||
README.1st | ||
README.linux | ||
sysklogd.8 | ||
syslog_tst.c | ||
syslog-tst.conf | ||
syslog.c | ||
syslog.conf | ||
syslog.conf.5 | ||
syslogd.8 | ||
syslogd.c | ||
version.h |
Welcome to the sysklogd package for Linux. All the utility documentation has now been moved into the man pages. Please review these carefully before proceeding. Version 1.3 of the package is the culmination of about two years of experience and bug reports on the 1.2 version from both the INTERNET and our corporate Linux networks. The utilities in this package should provide VERY reliable system logging. Klogd and syslogd have both been stress tested in kernel development environments where literally hundreds of megabytes of kernel messages have been blasted through them. If either utility should fail the development team would appreciate debug information so that the bug can be reproduced and squashed. Both utilities (syslogd, klogd) can be either run from init or started as part of the rc.* sequence. Caution should be used when starting these utilities from init since the default configuration is for both of these utilities to auto-background themselves. Depending on the version of init being used this could either result in the process table being filled or at least 10 copies of the daemon being started. If auto-backgrounding is NOT desired the command line option -n should be used to disable the auto-fork feature. I have found work on the sysklogd package to be an interesting example of the powers of the INTERNET. Stephen, Juha, Shane, Martin and myself have successfully collaborated on the development of this package without ever having met each other, in fact we could pass on the street without realizing it. What I have developed is a profound respect for the personal capabilities of each one of these individuals. Perhaps the greatest `Linux Legacy' will be that its development/enhancement is truly an example of the powers of international cooperation through the worldwide INTERNET. We would be interested in keeping track of any and all bug fixes/changes that are made. At the time that work was started on the sysklogd package the syslog(d) sources seemed to have fallen into neglect. This work started with and continues the believe that it is important to maintain consistent standardized system utilities sources. Hopefully the Linux community will find these sources to be a useful addition to the software gene pool. There is a mailing list covering this package and syslog in general. The lists address is infodrom-sysklogd@lists.infodrom.org . To subscribe send a mail to majordomo@lists.infodrom.org with a line "subscribe infodrom-sysklogd" in the message body. A second mailing list exists as infodrom-sysklogd-cvs@lists.infodrom.org. Only CVS messages and diffs are distributed there. Whenever new code is added to sysklogd, CVS generates a mail from these changes which will be sent to this list. Discussions will take place on the first list. The latest version of this software can be found at: http://www.infodrom.org/projects/sysklogd/download.php3 Best regards, Dr. Wettstein Oncology Research Division Computing Facility Roger Maris Cancer Center Fargo, ND greg@wind.enjellic.com Stephen Tweedie Department of Computer Science Edinburgh University, Scotland Juha Virtanen jiivee@hut.fi Shane Alderton shane@ion.apana.org.au Martin Schulze Infodrom Oldenburg joey@infodrom.org And a number of bug reporters whose contributions cannot be underestimated.